diff --git a/frameworks/libs/distributeddb/common/include/db_types.h b/frameworks/libs/distributeddb/common/include/db_types.h
index 95c3e5b6192bf2088666a6a317e51f610487e3eb..7c83fff420bfe359c4fb29f1f8ff2d611082a648 100644
--- a/frameworks/libs/distributeddb/common/include/db_types.h
+++ b/frameworks/libs/distributeddb/common/include/db_types.h
@@ -189,5 +189,10 @@ enum class CompressAlgorithm : uint8_t {
     NONE = 0,
     ZLIB = 1
 };
+
+struct PermissionCheckRet {
+    bool isPass = false; // run permission check res
+    DataFlowCheckRet ret = DataFlowCheckRet::DEFAULT;
+};
 } // namespace DistributedDB
 #endif // DISTRIBUTEDDB_TYPES_H
diff --git a/frameworks/libs/distributeddb/common/include/runtime_context.h b/frameworks/libs/distributeddb/common/include/runtime_context.h
index bfe66fd0ddad4b2ca8dbb747c09d14cf24b3f533..5d89107b38e4847c1ce892b9c3850f649e210266 100644
--- a/frameworks/libs/distributeddb/common/include/runtime_context.h
+++ b/frameworks/libs/distributeddb/common/include/runtime_context.h
@@ -90,7 +90,8 @@ public:
 
     virtual int SetPermissionCheckCallback(const PermissionCheckCallbackV4 &callback) = 0;
 
-    virtual int RunPermissionCheck(const PermissionCheckParam &param, uint8_t flag) const = 0;
+    virtual PermissionCheckRet RunPermissionCheck(const PermissionCheckParam &param,
+        const Property property, uint8_t flag) const = 0;
 
     virtual int EnableKvStoreAutoLaunch(const KvDBProperties &properties, AutoLaunchNotifier notifier,
         const AutoLaunchOption &option) = 0;
@@ -211,6 +212,8 @@ public:
     virtual std::shared_ptr<AssetsDownloadManager> GetAssetsDownloadManager() = 0;
 
     virtual void ClearOnlineLabel() = 0;
+
+    virtual int SetDataFlowCheckCallback(const DataFlowCheckCallback &callback) = 0;
 protected:
     RuntimeContext() = default;
     virtual ~RuntimeContext() {}
diff --git a/frameworks/libs/distributeddb/common/src/runtime_context_impl.cpp b/frameworks/libs/distributeddb/common/src/runtime_context_impl.cpp
index 73d6e7b10e2646fd0b2bff355b097860f95e63bd..767b94fdc1cb5de47bcd33f9bf4f0211678d0d60 100644
--- a/frameworks/libs/distributeddb/common/src/runtime_context_impl.cpp
+++ b/frameworks/libs/distributeddb/common/src/runtime_context_impl.cpp
@@ -372,9 +372,18 @@ int RuntimeContextImpl::SetPermissionCheckCallback(const PermissionCheckCallback
     return E_OK;
 }
 
-int RuntimeContextImpl::RunPermissionCheck(const PermissionCheckParam &param, uint8_t flag) const
+int RuntimeContextImpl::SetDataFlowCheckCallback(const DataFlowCheckCallback &callback)
 {
-    bool checkResult = false;
+    std::unique_lock<std::shared_mutex> writeLock(permissionCheckCallbackMutex_);
+    dataFlowCheckCallback_ = callback;
+    LOGI("SetDataFlowCheckCallback ok");
+    return E_OK;
+}
+
+PermissionCheckRet RuntimeContextImpl::RunPermissionCheck(const PermissionCheckParam &param,
+    const Property property, uint8_t flag) const
+{
+    PermissionCheckRet ret;
     std::shared_lock<std::shared_mutex> autoLock(permissionCheckCallbackMutex_);
     if (permissionCheckCallbackV4_) {
         PermissionCheckParamV4 paramV4;
@@ -383,20 +392,26 @@ int RuntimeContextImpl::RunPermissionCheck(const PermissionCheckParam &param, ui
         paramV4.storeId = param.storeId;
         paramV4.deviceId = param.deviceId;
         paramV4.subUserId = param.subUserId;
-        checkResult = permissionCheckCallbackV4_(paramV4, flag);
+        ret.isPass = permissionCheckCallbackV4_(paramV4, flag);
     } else if (permissionCheckCallbackV3_) {
-        checkResult = permissionCheckCallbackV3_(param, flag);
+        ret.isPass = permissionCheckCallbackV3_(param, flag);
     } else if (permissionCheckCallbackV2_) {
-        checkResult = permissionCheckCallbackV2_(param.userId, param.appId, param.storeId, param.deviceId, flag);
+        ret.isPass = permissionCheckCallbackV2_(param.userId, param.appId, param.storeId, param.deviceId, flag);
     } else if (permissionCheckCallback_) {
-        checkResult = permissionCheckCallback_(param.userId, param.appId, param.storeId, flag);
+        ret.isPass = permissionCheckCallback_(param.userId, param.appId, param.storeId, flag);
     } else {
-        return E_OK;
+        ret.isPass = true;
     }
-    if (checkResult) {
-        return E_OK;
+    if (dataFlowCheckCallback_) {
+        ret.ret = dataFlowCheckCallback_(param, property);
     }
-    return -E_NOT_PERMIT;
+    LOGI("RunPermissionCheck userId[%s] appId[%s] storeId[%s] isPass[%d] dataFlow[%d]",
+         DBCommon::StringMiddleMasking(param.userId).c_str(),
+         DBCommon::StringMiddleMasking(param.appId).c_str(),
+         DBCommon::StringMiddleMasking(param.storeId).c_str(),
+         static_cast<int>(ret.isPass),
+         static_cast<int>(ret.ret));
+    return ret;
 }
 
 int RuntimeContextImpl::EnableKvStoreAutoLaunch(const KvDBProperties &properties, AutoLaunchNotifier notifier,
diff --git a/frameworks/libs/distributeddb/common/src/runtime_context_impl.h b/frameworks/libs/distributeddb/common/src/runtime_context_impl.h
index 08fe5988cc37ac9e93ca095e824f4d77d0e5357f..faceb0244f3da89c073f132b39ce9fcf0db9830c 100644
--- a/frameworks/libs/distributeddb/common/src/runtime_context_impl.h
+++ b/frameworks/libs/distributeddb/common/src/runtime_context_impl.h
@@ -73,7 +73,8 @@ public:
 
     int SetPermissionCheckCallback(const PermissionCheckCallbackV4 &callback) override;
 
-    int RunPermissionCheck(const PermissionCheckParam &param, uint8_t flag) const override;
+    PermissionCheckRet RunPermissionCheck(const PermissionCheckParam &param,
+        const Property property, uint8_t flag) const override;
 
     int EnableKvStoreAutoLaunch(const KvDBProperties &properties, AutoLaunchNotifier notifier,
         const AutoLaunchOption &option) override;
@@ -192,9 +193,9 @@ public:
     std::shared_ptr<AssetsDownloadManager> GetAssetsDownloadManager() override;
 
     void ClearOnlineLabel() override;
-private:
-    static constexpr int TASK_POOL_REPORTS_INTERVAL = 10000;   // task pool reports its state every 10 seconds.
 
+    int SetDataFlowCheckCallback(const DataFlowCheckCallback &callback) override;
+private:
     int PrepareLoop(IEventLoop *&loop);
     int AllocTimerId(IEvent *evTimer, TimerId &timerId);
     std::shared_ptr<DBStatusAdapter> GetDBStatusAdapter();
@@ -236,6 +237,7 @@ private:
     PermissionCheckCallbackV2 permissionCheckCallbackV2_;
     PermissionCheckCallbackV3 permissionCheckCallbackV3_;
     PermissionCheckCallbackV4 permissionCheckCallbackV4_;
+    DataFlowCheckCallback dataFlowCheckCallback_;
 
     AutoLaunch autoLaunch_;
 
diff --git a/frameworks/libs/distributeddb/include/types_export.h b/frameworks/libs/distributeddb/include/types_export.h
index 7bdac3a8b3e23f374987bfcf6919fe8eba01b872..61d3328d64d55e9d7eaf06eda2b11c232ea35ba2 100644
--- a/frameworks/libs/distributeddb/include/types_export.h
+++ b/frameworks/libs/distributeddb/include/types_export.h
@@ -22,6 +22,7 @@
 #include <map>
 #include <set>
 #include <string>
+#include <variant>
 #include <vector>
 
 namespace DistributedDB {
@@ -42,6 +43,9 @@ using Value = std::vector<uint8_t>;
 
 using AssetsMap = std::map<std::string, std::set<std::string>>;
 using AssetsGroupMap = std::map<uint32_t, AssetsMap>;
+using Nil = std::monostate;
+using PropertyType = std::variant<Nil, uint32_t, std::string>;
+using Property = std::map<std::string, PropertyType>;
 
 struct Entry {
     Key key;
@@ -168,6 +172,14 @@ using PermissionCheckCallbackV3 = std::function<bool (const PermissionCheckParam
 
 using PermissionCheckCallbackV4 = std::function<bool (const PermissionCheckParamV4 &param, uint8_t flag)>;
 
+enum class DataFlowCheckRet : uint32_t {
+    DEFAULT = 0, // allow to send and receive data
+    DENIED_SEND = 1, // only allow to receive data
+    BUTT // last ret and it is invalid
+};
+using DataFlowCheckCallback =
+    std::function<DataFlowCheckRet (const PermissionCheckParam &param, const Property &property)>;
+
 using StoreStatusNotifier = std::function<void (std::string userId, std::string appId, std::string storeId,
     const std::string deviceId, bool onlineStatus)>; // status, 1: online, 0: offline
 
diff --git a/frameworks/libs/distributeddb/interfaces/include/cloud/cloud_store_types.h b/frameworks/libs/distributeddb/interfaces/include/cloud/cloud_store_types.h
index 860fb5c96f08b90696f45446bdc42743bde33f37..5d8b3c417a9cad233a8d6119c63489ca5e47d4d5 100644
--- a/frameworks/libs/distributeddb/interfaces/include/cloud/cloud_store_types.h
+++ b/frameworks/libs/distributeddb/interfaces/include/cloud/cloud_store_types.h
@@ -102,7 +102,6 @@ struct Asset {
             (status == asset.status) && (timestamp == asset.timestamp);
     }
 };
-using Nil = std::monostate;
 using Assets = std::vector<Asset>;
 using Bytes = std::vector<uint8_t>;
 using Entries = std::map<std::string, std::string>;
diff --git a/frameworks/libs/distributeddb/interfaces/include/kv_store_nb_delegate.h b/frameworks/libs/distributeddb/interfaces/include/kv_store_nb_delegate.h
index 24bb48050ed9781781223a3c881f14c738bb53c6..f61380b7a1c2011f8f224e24ff45df09d99b1ebc 100644
--- a/frameworks/libs/distributeddb/interfaces/include/kv_store_nb_delegate.h
+++ b/frameworks/libs/distributeddb/interfaces/include/kv_store_nb_delegate.h
@@ -341,6 +341,12 @@ public:
     {
         return OK;
     }
+
+    // Use for DataFlowCheckCallback
+    DB_API virtual DBStatus SetProperty(const Property &property)
+    {
+        return OK;
+    }
 };
 } // namespace DistributedDB
 
diff --git a/frameworks/libs/distributeddb/interfaces/include/relational/relational_store_delegate.h b/frameworks/libs/distributeddb/interfaces/include/relational/relational_store_delegate.h
index 78f69dfa8d41de7dc972184e48c21376edc71146..7b2df9607412e2132522741a5b933b0389a5eefe 100644
--- a/frameworks/libs/distributeddb/interfaces/include/relational/relational_store_delegate.h
+++ b/frameworks/libs/distributeddb/interfaces/include/relational/relational_store_delegate.h
@@ -173,6 +173,12 @@ public:
     {
         return 0;
     }
+
+    // Use for DataFlowCheckCallback
+    DB_API virtual DBStatus SetProperty(const Property &property)
+    {
+        return OK;
+    }
 protected:
     virtual DBStatus RemoveDeviceDataInner(const std::string &device, ClearMode mode) = 0;
     virtual DBStatus CreateDistributedTableInner(const std::string &tableName, TableSyncType type) = 0;
diff --git a/frameworks/libs/distributeddb/interfaces/include/runtime_config.h b/frameworks/libs/distributeddb/interfaces/include/runtime_config.h
index 2e87ba34d0a53b05eada471aa5edfcdf1d0c6d69..32492821d82af29dd41df84dca22710d014f65c7 100644
--- a/frameworks/libs/distributeddb/interfaces/include/runtime_config.h
+++ b/frameworks/libs/distributeddb/interfaces/include/runtime_config.h
@@ -86,6 +86,8 @@ public:
     DB_API static void SetCloudTranslate(const std::shared_ptr<ICloudDataTranslate> &dataTranslate);
 
     DB_API static DBStatus SetAsyncDownloadAssetsConfig(const AsyncDownloadAssetsConfig &config);
+
+    DB_API static DBStatus SetDataFlowCheckCallback(const DataFlowCheckCallback &callback);
 private:
     static std::mutex communicatorMutex_;
     static std::mutex multiUserMutex_;
diff --git a/frameworks/libs/distributeddb/interfaces/src/kv_store_nb_delegate_impl.cpp b/frameworks/libs/distributeddb/interfaces/src/kv_store_nb_delegate_impl.cpp
index defc53f1bcafe730ffe2db9ba1b43061522cdb2c..9177ef0d4c26a12ec9a1352613a78a109ba4fdb1 100644
--- a/frameworks/libs/distributeddb/interfaces/src/kv_store_nb_delegate_impl.cpp
+++ b/frameworks/libs/distributeddb/interfaces/src/kv_store_nb_delegate_impl.cpp
@@ -1446,4 +1446,13 @@ DBStatus KvStoreNbDelegateImpl::SetDeviceSyncNotify(DeviceSyncEvent event, const
     }
     return TransferDBErrno(conn_->SetDeviceSyncNotify(event, notifier));
 }
+
+DBStatus KvStoreNbDelegateImpl::SetProperty(const Property &property)
+{
+    if (conn_ == nullptr) {
+        LOGE("%s", INVALID_CONNECTION);
+        return DB_ERROR;
+    }
+    return TransferDBErrno(conn_->SetProperty(property));
+}
 } // namespace DistributedDB
diff --git a/frameworks/libs/distributeddb/interfaces/src/kv_store_nb_delegate_impl.h b/frameworks/libs/distributeddb/interfaces/src/kv_store_nb_delegate_impl.h
index ff3acc5c1ef94db274b9cf9b13cf8999f195efd6..7f5cef6d82d6321def3e70fdd729f0547a65bd27 100644
--- a/frameworks/libs/distributeddb/interfaces/src/kv_store_nb_delegate_impl.h
+++ b/frameworks/libs/distributeddb/interfaces/src/kv_store_nb_delegate_impl.h
@@ -28,7 +28,7 @@
 #include "kv_store_nb_delegate.h"
 
 namespace DistributedDB {
-class KvStoreNbDelegateImpl final : public KvStoreNbDelegate {
+class KvStoreNbDelegateImpl : public KvStoreNbDelegate {
 public:
     KvStoreNbDelegateImpl(IKvDBConnection *conn, const std::string &storeId);
     ~KvStoreNbDelegateImpl() override;
@@ -205,6 +205,7 @@ public:
 
     void SetHandle(void *handle);
 
+    DBStatus SetProperty(const Property &property) override;
 private:
     DBStatus GetInner(const IOption &option, const Key &key, Value &value) const;
     DBStatus PutInner(const IOption &option, const Key &key, const Value &value);
diff --git a/frameworks/libs/distributeddb/interfaces/src/relational/relational_store_delegate_impl.cpp b/frameworks/libs/distributeddb/interfaces/src/relational/relational_store_delegate_impl.cpp
index a68cca1fdcdb2d0bf2114ff10a4995520ac57c18..a42c7b7f350f2dd60b82f018dd2d36dc469fbdb9 100644
--- a/frameworks/libs/distributeddb/interfaces/src/relational/relational_store_delegate_impl.cpp
+++ b/frameworks/libs/distributeddb/interfaces/src/relational/relational_store_delegate_impl.cpp
@@ -608,5 +608,14 @@ int32_t RelationalStoreDelegateImpl::GetDeviceSyncTaskCount()
     LOGI("[RelationalStore Delegate] Get device sync task count %" PRId32, count);
     return count;
 }
+
+DBStatus RelationalStoreDelegateImpl::SetProperty(const Property &property)
+{
+    if (conn_ == nullptr) {
+        LOGE("[RelationalStore Delegate] Invalid connection for set property.");
+        return DB_ERROR;
+    }
+    return TransferDBErrno(conn_->SetProperty(property));
+}
 } // namespace DistributedDB
 #endif
\ No newline at end of file
diff --git a/frameworks/libs/distributeddb/interfaces/src/relational/relational_store_delegate_impl.h b/frameworks/libs/distributeddb/interfaces/src/relational/relational_store_delegate_impl.h
index de6060d9215dc491317f71490c258dbd5e8b9bce..df451ffe6d42c4c8febc54054ba92aa4e372f3ea 100644
--- a/frameworks/libs/distributeddb/interfaces/src/relational/relational_store_delegate_impl.h
+++ b/frameworks/libs/distributeddb/interfaces/src/relational/relational_store_delegate_impl.h
@@ -20,7 +20,7 @@
 #include "relational_store_connection.h"
 
 namespace DistributedDB {
-class RelationalStoreDelegateImpl final : public RelationalStoreDelegate {
+class RelationalStoreDelegateImpl : public RelationalStoreDelegate {
 public:
     RelationalStoreDelegateImpl() = default;
     ~RelationalStoreDelegateImpl() override;
@@ -96,6 +96,8 @@ public:
     DBStatus ClearMetaData(const ClearMetaDataOption &option) override;
 #endif
     int32_t GetDeviceSyncTaskCount() override;
+
+    DBStatus SetProperty(const Property &property) override;
 private:
     static void OnSyncComplete(const std::map<std::string, std::vector<TableStatus>> &devicesStatus,
         const SyncStatusCallback &onComplete);
diff --git a/frameworks/libs/distributeddb/interfaces/src/relational/relational_sync_able_storage.h b/frameworks/libs/distributeddb/interfaces/src/relational/relational_sync_able_storage.h
index e772c5c7e419ec300695dba44d7574c12369032e..b6139fd272fcaf805db3680402318c1f52a89120 100644
--- a/frameworks/libs/distributeddb/interfaces/src/relational/relational_sync_able_storage.h
+++ b/frameworks/libs/distributeddb/interfaces/src/relational/relational_sync_able_storage.h
@@ -271,6 +271,10 @@ public:
     bool IsExistTableContainAssets() override;
 
     int GetCompressionOption(bool &needCompressOnSync, uint8_t &compressionRate) const override;
+
+    void SetProperty(const Property &property);
+
+    Property GetProperty() const override;
 protected:
     int FillReferenceData(CloudSyncData &syncData);
 
@@ -389,6 +393,9 @@ private:
     std::map<std::string, std::pair<uint64_t, uint64_t>> cursorChangeMap_;
 
     std::mutex cursorChangeMutex_;
+
+    mutable std::mutex propertyMutex_;
+    Property property_;
 };
 }  // namespace DistributedDB
 #endif
diff --git a/frameworks/libs/distributeddb/interfaces/src/runtime_config.cpp b/frameworks/libs/distributeddb/interfaces/src/runtime_config.cpp
index 9d27786cf74c7b939a724f1e0b7f5e19cc78cc73..1bba41b71a428256281217d3221d54331be7a204 100644
--- a/frameworks/libs/distributeddb/interfaces/src/runtime_config.cpp
+++ b/frameworks/libs/distributeddb/interfaces/src/runtime_config.cpp
@@ -204,5 +204,10 @@ DBStatus RuntimeConfig::SetAsyncDownloadAssetsConfig(const AsyncDownloadAssetsCo
     return TransferDBErrno(RuntimeContext::GetInstance()->GetAssetsDownloadManager()
         ->SetAsyncDownloadAssetsConfig(config));
 }
+
+DBStatus RuntimeConfig::SetDataFlowCheckCallback(const DataFlowCheckCallback &callback)
+{
+    return TransferDBErrno(RuntimeContext::GetInstance()->SetDataFlowCheckCallback(callback));
+}
 } // namespace DistributedDB
 #endif
diff --git a/frameworks/libs/distributeddb/storage/include/ikvdb_connection.h b/frameworks/libs/distributeddb/storage/include/ikvdb_connection.h
index 3ad0172cc6d8c6c83263e1de6291f57e7046df5b..7a2cd7381690ee9f87be6968cfb543d6b9e7dd8e 100644
--- a/frameworks/libs/distributeddb/storage/include/ikvdb_connection.h
+++ b/frameworks/libs/distributeddb/storage/include/ikvdb_connection.h
@@ -176,6 +176,8 @@ public:
     virtual int OperateDataStatus(uint32_t dataOperator) = 0;
 
     virtual int SetDeviceSyncNotify(DeviceSyncEvent event, const DeviceSyncNotifier &notifier) = 0;
+
+    virtual int SetProperty(const Property &property) = 0;
 };
 } // namespace DistributedDB
 
diff --git a/frameworks/libs/distributeddb/storage/include/isync_interface.h b/frameworks/libs/distributeddb/storage/include/isync_interface.h
index 6a74a50c257dd3bdbd1f638fec9143c1b4c7ed46..101d7fb855d7f836aa4f3af909e4fae197e03b14 100644
--- a/frameworks/libs/distributeddb/storage/include/isync_interface.h
+++ b/frameworks/libs/distributeddb/storage/include/isync_interface.h
@@ -73,6 +73,8 @@ public:
     virtual int GetSecurityOption(SecurityOption &option) const = 0;
 
     virtual int IsSupportSubscribe() const = 0;
+
+    virtual Property GetProperty() const = 0;
 };
 } // namespace DistributedDB
 
diff --git a/frameworks/libs/distributeddb/storage/include/relational_store_connection.h b/frameworks/libs/distributeddb/storage/include/relational_store_connection.h
index acb034d762c26b5027bd936ddec9fc8555473c7a..49792c0496dd0d47a58c3821818d6c7df7dd1142 100644
--- a/frameworks/libs/distributeddb/storage/include/relational_store_connection.h
+++ b/frameworks/libs/distributeddb/storage/include/relational_store_connection.h
@@ -102,6 +102,8 @@ public:
     virtual int OperateDataStatus(uint32_t dataOperator) = 0;
 
     virtual int32_t GetDeviceSyncTaskCount() = 0;
+
+    virtual int SetProperty(const Property &property) = 0;
 protected:
     // Get the stashed 'RelationalDB_ pointer' without ref.
     template<typename DerivedDBType>
diff --git a/frameworks/libs/distributeddb/storage/include/sync_generic_interface.h b/frameworks/libs/distributeddb/storage/include/sync_generic_interface.h
index f8f6fb5759dd9a112dfcb38d9fc3f1ff174a8292..10029259d8537591598f89c254a4f9f83fe4ee28 100644
--- a/frameworks/libs/distributeddb/storage/include/sync_generic_interface.h
+++ b/frameworks/libs/distributeddb/storage/include/sync_generic_interface.h
@@ -172,6 +172,11 @@ public:
     {
         return E_OK;
     }
+
+    Property GetProperty() const override
+    {
+        return {};
+    }
 };
 }
 #endif // SYNC_GENERIC_INTERFACE_H
diff --git a/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb.cpp b/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb.cpp
index 71654c0425b3b958431010c8d149ab18eb382612..e1783bb68ce4c9d048e794367225142f275ce4f2 100644
--- a/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb.cpp
+++ b/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb.cpp
@@ -431,4 +431,13 @@ int GenericKvDB::PreClose()
     // it will not cause busy when close db, only to verify the last conn
     return -E_BUSY;
 }
+
+void GenericKvDB::SetProperty(const Property &property)
+{
+    auto storeId = MyProp().GetStringProp(KvDBProperties::STORE_ID, "");
+    std::lock_guard<std::mutex> autoLock(propertyMutex_);
+    LOGI("KV set storeId[%s] property from [%zu] to [%zu]", DBCommon::StringMiddleMasking(storeId).c_str(),
+        property_.size(), property.size());
+    property_ = property;
+}
 } // namespace DistributedDB
diff --git a/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb.h b/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb.h
index 4b9bbd5ce927a7257627a2ccd76b9378a581250d..94cd7f813155c84c5f10b0919e1d15fa9d8a3700 100644
--- a/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb.h
+++ b/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb.h
@@ -136,6 +136,8 @@ public:
     void MarkRebuild() override;
 
     virtual int PreClose();
+
+    void SetProperty(const Property &property);
 protected:
     // Create a connection object, no DB ref increased.
     virtual GenericKvDBConnection *NewConnection(int &errCode) = 0;
@@ -173,6 +175,8 @@ protected:
     PerformanceAnalysis *performance_;
     DatabaseCorruptHandler corruptHandler_;
     DeviceID devId_;
+    mutable std::mutex propertyMutex_;
+    Property property_;
 
 private:
     // Do commit notify in task pool.
diff --git a/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb_connection.cpp b/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb_connection.cpp
index ca3566fbce93031f2a512f7aaedb3b13e36d5a9f..e9627ed81fed97a6f8036cbcf925e312c813025d 100644
--- a/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb_connection.cpp
+++ b/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb_connection.cpp
@@ -472,4 +472,13 @@ int GenericKvDBConnection::SetDeviceSyncNotify([[gnu::unused]] DeviceSyncEvent e
 {
     return -E_NOT_SUPPORT;
 }
+
+int GenericKvDBConnection::SetProperty(const Property &property)
+{
+    if (kvDB_ == nullptr) {
+        return -E_INVALID_CONNECTION;
+    }
+    kvDB_->SetProperty(property);
+    return E_OK;
+}
 }
\ No newline at end of file
diff --git a/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb_connection.h b/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb_connection.h
index 194dc3f0677a2f084933de0a860c138f641a023e..74955f5dc29892ac682db2456f2d6a3de84796e7 100644
--- a/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb_connection.h
+++ b/frameworks/libs/distributeddb/storage/src/kv/generic_kvdb_connection.h
@@ -118,6 +118,8 @@ public:
     int OperateDataStatus(uint32_t dataOperator) override;
 
     int SetDeviceSyncNotify(DeviceSyncEvent event, const DeviceSyncNotifier &notifier) override;
+
+    int SetProperty(const Property &property) override;
 protected:
     // Get the stashed 'KvDB_ pointer' without ref.
     template<typename DerivedDBType>
diff --git a/frameworks/libs/distributeddb/storage/src/relational/relational_sync_able_storage_extend.cpp b/frameworks/libs/distributeddb/storage/src/relational/relational_sync_able_storage_extend.cpp
index c44c11b309019668de44310c06747d5c57b3967f..18e54506b3d4e41d8607006533d436c809afbe11 100644
--- a/frameworks/libs/distributeddb/storage/src/relational/relational_sync_able_storage_extend.cpp
+++ b/frameworks/libs/distributeddb/storage/src/relational/relational_sync_able_storage_extend.cpp
@@ -631,5 +631,20 @@ int RelationalSyncAbleStorage::GetCompressionOption(bool &needCompressOnSync, ui
         DBConstant::DEFAULT_COMPTRESS_RATE);
     return E_OK;
 }
+
+void RelationalSyncAbleStorage::SetProperty(const Property &property)
+{
+    auto storeId = GetDbProperties().GetStringProp(DBProperties::STORE_ID, "");
+    std::lock_guard<std::mutex> autoLock(propertyMutex_);
+    LOGI("RDB set storeId[%s] property from [%zu] to [%zu]", DBCommon::StringMiddleMasking(storeId).c_str(),
+         property_.size(), property.size());
+    property_ = property;
+}
+
+Property RelationalSyncAbleStorage::GetProperty() const
+{
+    std::lock_guard<std::mutex> autoLock(propertyMutex_);
+    return property_;
+}
 }
 #endif
diff --git a/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store.cpp b/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store.cpp
index 070deaf85c45c5251d3cd0ea5ec5cbb8bb3ec923..c859a49db43bf42419be5312d35330f0a4c4e912 100644
--- a/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store.cpp
+++ b/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store.cpp
@@ -1989,5 +1989,14 @@ RelationalSchemaObject SQLiteRelationalStore::GetSchemaObj() const
     }
     return storageEngine_->GetSchemaInfo();
 }
+
+int SQLiteRelationalStore::SetProperty(const Property &property)
+{
+    if (storageEngine_ == nullptr) {
+        return -E_INVALID_DB;
+    }
+    storageEngine_->SetProperty(property);
+    return E_OK;
+}
 } // namespace DistributedDB
 #endif
diff --git a/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store.h b/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store.h
index f4ac621ddbfb7c31ae8c0ff466484f0820aa3a10..5e32cbba4eaccc4f6e40de0a63f763fbe0495731 100644
--- a/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store.h
+++ b/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store.h
@@ -124,6 +124,8 @@ public:
     int OperateDataStatus(uint32_t dataOperator);
 
     int32_t GetDeviceSyncTaskCount() const;
+
+    int SetProperty(const Property &property);
 protected:
     void ReleaseResources();
 
diff --git a/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store_connection.cpp b/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store_connection.cpp
index 48d4e797db10d938a64c7c992f3a78bb0f9e7e4f..ed7574626eafc23a02fb7c479d726f59474ebf83 100644
--- a/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store_connection.cpp
+++ b/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store_connection.cpp
@@ -535,5 +535,15 @@ int32_t SQLiteRelationalStoreConnection::GetDeviceSyncTaskCount()
     }
     return store->GetDeviceSyncTaskCount();
 }
+
+int SQLiteRelationalStoreConnection::SetProperty(const Property &property)
+{
+    auto *store = GetDB<SQLiteRelationalStore>();
+    if (store == nullptr) {
+        LOGE("[RelationalConnection] store is null when set property.");
+        return -E_INVALID_CONNECTION;
+    }
+    return store->SetProperty(property);
+}
 }
 #endif
\ No newline at end of file
diff --git a/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store_connection.h b/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store_connection.h
index 10dc6cba27d61e1e8aa4c1695c504dd3bc7b11bc..bfd80a95778547bac228dd1a7ccd28ae494928b6 100644
--- a/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store_connection.h
+++ b/frameworks/libs/distributeddb/storage/src/sqlite/relational/sqlite_relational_store_connection.h
@@ -86,6 +86,8 @@ public:
     int OperateDataStatus(uint32_t dataOperator) override;
 
     int32_t GetDeviceSyncTaskCount() override;
+
+    int SetProperty(const Property &property) override;
 protected:
 
     int Pragma(int cmd, void *parameter) override;
diff --git a/frameworks/libs/distributeddb/storage/src/sqlite/sqlite_single_ver_natural_store.h b/frameworks/libs/distributeddb/storage/src/sqlite/sqlite_single_ver_natural_store.h
index 473f9dca6960b59d30d12b9daf878290d29a4a82..8e5509d966ad9d475f21ac3b59b87802dbaaa110 100644
--- a/frameworks/libs/distributeddb/storage/src/sqlite/sqlite_single_ver_natural_store.h
+++ b/frameworks/libs/distributeddb/storage/src/sqlite/sqlite_single_ver_natural_store.h
@@ -264,6 +264,8 @@ protected:
 
     bool CheckSchemaSupportForCloudSync() const override;
 #endif
+
+    Property GetProperty() const override;
 private:
 
     int CheckDatabaseRecovery(const KvDBProperties &kvDBProp);
diff --git a/frameworks/libs/distributeddb/storage/src/sqlite/sqlite_single_ver_natural_store_extend.cpp b/frameworks/libs/distributeddb/storage/src/sqlite/sqlite_single_ver_natural_store_extend.cpp
index 092dd0e104146d4ef071eb3ee6242ff440808189..d9ff7589ca6e663392af35b6d4a6da09c3eb2033 100644
--- a/frameworks/libs/distributeddb/storage/src/sqlite/sqlite_single_ver_natural_store_extend.cpp
+++ b/frameworks/libs/distributeddb/storage/src/sqlite/sqlite_single_ver_natural_store_extend.cpp
@@ -821,4 +821,10 @@ std::function<int(void)> SQLiteSingleVerNaturalStore::ClearCloudWatermarkInner()
     };
 }
 #endif
+
+Property SQLiteSingleVerNaturalStore::GetProperty() const
+{
+    std::lock_guard<std::mutex> autoLock(propertyMutex_);
+    return property_;
+}
 }
diff --git a/frameworks/libs/distributeddb/syncer/src/device/remote_executor.cpp b/frameworks/libs/distributeddb/syncer/src/device/remote_executor.cpp
index c38dfb346a9511e6fbf15839ebb8488af5f8686f..d99d94dec504fd81c7e63ccb406b6fb7369a61b8 100644
--- a/frameworks/libs/distributeddb/syncer/src/device/remote_executor.cpp
+++ b/frameworks/libs/distributeddb/syncer/src/device/remote_executor.cpp
@@ -205,18 +205,23 @@ void RemoteExecutor::ParseOneRequestMessage(const std::string &device, Message *
         LOGW("[RemoteExecutor][ParseOneRequestMessage] closed");
         return;
     }
-    int errCode = CheckPermissions(device, inMsg);
+    bool isDeniedSend = false;
+    int errCode = CheckPermissions(device, inMsg, isDeniedSend);
     if (errCode != E_OK) {
         (void)ResponseFailed(errCode, inMsg->GetSessionId(), inMsg->GetSequenceId(), device);
         return;
     }
+    if (isDeniedSend) {
+        (void)ResponseFailed(E_OK, inMsg->GetSessionId(), 1, device); // sequenceId always 1
+        return;
+    }
     errCode = SendRemoteExecutorData(device, inMsg);
     if (errCode != E_OK) {
         (void)ResponseFailed(errCode, inMsg->GetSessionId(), inMsg->GetSequenceId(), device);
     }
 }
 
-int RemoteExecutor::CheckPermissions(const std::string &device, Message *inMsg)
+int RemoteExecutor::CheckPermissions(const std::string &device, Message *inMsg, bool &isDeniedSend)
 {
     SyncGenericInterface *storage = static_cast<SyncGenericInterface *>(GetAndIncSyncInterface());
     if (storage == nullptr) {
@@ -229,12 +234,16 @@ int RemoteExecutor::CheckPermissions(const std::string &device, Message *inMsg)
     std::string storeId = storage->GetDbProperties().GetStringProp(DBProperties::STORE_ID, "");
     std::string subUseId = storage->GetDbProperties().GetStringProp(DBProperties::SUB_USER, "");
     int32_t instanceId = syncInterface_->GetDbProperties().GetIntProp(DBProperties::INSTANCE_ID, 0);
-    int errCode = RuntimeContext::GetInstance()->RunPermissionCheck(
-        { userId, appId, storeId, device, subUseId, instanceId }, CHECK_FLAG_SEND);
-    if (errCode != E_OK) {
-        LOGE("[RemoteExecutor][CheckPermissions] check permission errCode = %d.", errCode);
+    auto checkRet = RuntimeContext::GetInstance()->RunPermissionCheck(
+        { userId, appId, storeId, device, subUseId, instanceId }, syncInterface_->GetProperty(), CHECK_FLAG_SEND);
+    if (!checkRet.isPass) {
         storage->DecRefCount();
-        return errCode;
+        return -E_NOT_PERMIT;
+    }
+    if (checkRet.ret == DataFlowCheckRet::DENIED_SEND) {
+        storage->DecRefCount();
+        isDeniedSend = true;
+        return E_OK;
     }
     const auto *packet = inMsg->GetObject<ISyncPacket>();
     if (packet == nullptr) {
@@ -243,7 +252,7 @@ int RemoteExecutor::CheckPermissions(const std::string &device, Message *inMsg)
         return -E_INVALID_ARGS;
     }
     const auto *requestPacket = static_cast<const RemoteExecutorRequestPacket *>(packet);
-    errCode = CheckRemoteRecvData(device, storage, requestPacket->GetSecLabel(), requestPacket->GetVersion());
+    int errCode = CheckRemoteRecvData(device, storage, requestPacket->GetSecLabel(), requestPacket->GetVersion());
     storage->DecRefCount();
     return errCode;
 }
diff --git a/frameworks/libs/distributeddb/syncer/src/device/remote_executor.h b/frameworks/libs/distributeddb/syncer/src/device/remote_executor.h
index 5343e8fb4fe37355fa4f2b21ba7d180374b96ba3..3cb5975633c01bf8343e5b2250aea1827112fd80 100644
--- a/frameworks/libs/distributeddb/syncer/src/device/remote_executor.h
+++ b/frameworks/libs/distributeddb/syncer/src/device/remote_executor.h
@@ -95,7 +95,7 @@ private:
 
     int ReceiveRemoteExecutorAck(const std::string &targetDev, Message *inMsg);
 
-    int CheckPermissions(const std::string &device, Message *inMsg);
+    int CheckPermissions(const std::string &device, Message *inMsg, bool &isDeniedSend);
 
     int SendRemoteExecutorData(const std::string &device, const Message *inMsg);
 
diff --git a/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync.cpp b/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync.cpp
index 72537fd5c00759a8f27c114689fd261b8ee4b047..536125edf921a85f04a810b6701609e9a0d61af2 100644
--- a/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync.cpp
+++ b/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync.cpp
@@ -1093,7 +1093,7 @@ int SingleVerDataSync::SendDataPacket(SyncType syncType, DataRequestPacket *pack
 }
 
 int SingleVerDataSync::SendPullResponseDataPkt(int ackCode, SyncEntry &syncOutData,
-    SingleVerSyncTaskContext *context)
+    SingleVerSyncTaskContext *context, uint32_t sessionId)
 {
     DataRequestPacket *packet = new (std::nothrow) DataRequestPacket;
     if (packet == nullptr) {
@@ -1104,7 +1104,7 @@ int SingleVerDataSync::SendPullResponseDataPkt(int ackCode, SyncEntry &syncOutDa
     FillDataRequestPacket(packet, context, syncOutData, ackCode, SyncModeType::RESPONSE_PULL);
 
     if ((ackCode == E_OK || ackCode == SEND_FINISHED) &&
-        SingleVerDataSyncUtils::IsSupportRequestTotal(packet->GetVersion())) {
+        SingleVerDataSyncUtils::IsSupportRequestTotal(packet->GetVersion()) && sessionId == 0) {
         uint32_t total = 0u;
         (void)SingleVerDataSyncUtils::GetUnsyncTotal(context, storage_, total);
         LOGD("[SendPullResponseDataPkt] GetUnsyncTotal total=%u", total);
@@ -1128,8 +1128,11 @@ int SingleVerDataSync::SendPullResponseDataPkt(int ackCode, SyncEntry &syncOutDa
         LOGE("[SendPullResponseDataPkt] set external object failed, errCode=%d", errCode);
         return errCode;
     }
+    if (sessionId == 0) {
+        sessionId = context->GetResponseSessionId();
+    }
     SingleVerDataSyncUtils::SetMessageHeadInfo(*message, TYPE_REQUEST, context->GetDeviceId(),
-        context->GetSequenceId(), context->GetResponseSessionId());
+        context->GetSequenceId(), sessionId);
     SendResetWatchDogPacket(context, packetLen);
     errCode = Send(context, message, nullptr, packetLen);
     if (errCode != E_OK) {
@@ -1345,8 +1348,8 @@ int SingleVerDataSync::RunPermissionCheck(SingleVerSyncTaskContext *context, con
     const DataRequestPacket *packet)
 {
     int mode = SyncOperation::TransferSyncMode(packet->GetMode());
-    int errCode = SingleVerDataSyncUtils::RunPermissionCheck(context, storage_, label_, packet);
-    if (errCode != E_OK) {
+    auto checkRet = SingleVerDataSyncUtils::RunPermissionCheck(context, storage_, label_, packet);
+    if (!checkRet.isPass) {
         if (context->GetRemoteSoftwareVersion() > SOFTWARE_VERSION_EARLIEST) { // ver 101 can't handle this errCode
             (void)SendDataAck(context, message, -E_NOT_PERMIT, 0);
         }
@@ -1370,6 +1373,11 @@ int SingleVerDataSync::RunPermissionCheck(SingleVerSyncTaskContext *context, con
             return -E_SECURITY_OPTION_CHECK_ERROR;
         }
     }
+    int errCode = E_OK;
+    if (checkRet.ret == DataFlowCheckRet::DENIED_SEND && ((mode == PUSH_AND_PULL) || (mode == PULL))) {
+        SyncEntry entry;
+        errCode = SendPullResponseDataPkt(SEND_FINISHED, entry, context, packet->GetSessionId());
+    }
     return errCode;
 }
 
diff --git a/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync.h b/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync.h
index ec1279f25bd60e4f1cb8eef5ff2c7a17870351cc..06cc51c25211525c5c401d40a0447835c2a099e1 100644
--- a/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync.h
+++ b/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync.h
@@ -211,7 +211,8 @@ protected:
     int SendReSendPacket(DataRequestPacket *packet, SingleVerSyncTaskContext *context,
         uint32_t sessionId, uint32_t sequenceId);
 
-    int SendPullResponseDataPkt(int ackCode, SyncEntry &syncOutData, SingleVerSyncTaskContext *context);
+    int SendPullResponseDataPkt(int ackCode, SyncEntry &syncOutData, SingleVerSyncTaskContext *context,
+        uint32_t sessionId = 0);
 
     int CheckSchemaStrategy(SingleVerSyncTaskContext *context, const Message *message);
 
diff --git a/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync_utils.cpp b/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync_utils.cpp
index 3d736b641cb321dec7d47f698f3771bb78a63d32..83046a5ab25c40198e6983bf16e88baa4765c921 100644
--- a/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync_utils.cpp
+++ b/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync_utils.cpp
@@ -197,19 +197,13 @@ void SingleVerDataSyncUtils::TranslateErrCodeIfNeed(int mode, uint32_t version,
     }
 }
 
-int SingleVerDataSyncUtils::RunPermissionCheck(SingleVerSyncTaskContext *context, const SyncGenericInterface* storage,
-    const std::string &label, const DataRequestPacket *packet)
+PermissionCheckRet SingleVerDataSyncUtils::RunPermissionCheck(SingleVerSyncTaskContext *context,
+    const SyncGenericInterface* storage, const std::string &label, const DataRequestPacket *packet)
 {
     int mode = SyncOperation::TransferSyncMode(packet->GetMode());
     return RunPermissionCheckInner(context, storage, label, packet, mode);
 }
 
-int SingleVerDataSyncUtils::RunPermissionCheck(SingleVerSyncTaskContext *context, const SyncGenericInterface* storage,
-    const std::string &label, int mode)
-{
-    return RunPermissionCheckInner(context, storage, label, nullptr, mode);
-}
-
 bool SingleVerDataSyncUtils::CheckPermitReceiveData(const SingleVerSyncTaskContext *context,
     const ICommunicator *communicator, const SyncGenericInterface *storage)
 {
@@ -482,7 +476,7 @@ SyncTimeRange SingleVerDataSyncUtils::GetSyncDataTimeRange(SyncType syncType, Wa
     return SingleVerDataSyncUtils::GetQuerySyncDataTimeRange(inData, localMark, deleteMark, isUpdate);
 }
 
-int SingleVerDataSyncUtils::RunPermissionCheckInner(const SingleVerSyncTaskContext *context,
+PermissionCheckRet SingleVerDataSyncUtils::RunPermissionCheckInner(const SingleVerSyncTaskContext *context,
     const SyncGenericInterface* storage, const std::string &label, const DataRequestPacket *packet, int mode)
 {
     PermissionCheckParam param;
@@ -492,12 +486,7 @@ int SingleVerDataSyncUtils::RunPermissionCheckInner(const SingleVerSyncTaskConte
     if (packet != nullptr) {
         param.extraConditions = packet->GetExtraConditions();
     }
-    int errCode = RuntimeContext::GetInstance()->RunPermissionCheck(param, flag);
-    if (errCode != E_OK) {
-        LOGE("[DataSync][RunPermissionCheck] check failed flag=%" PRIu8 ",dev=%s", flag,
-            STR_MASK(context->GetDeviceId()));
-    }
-    return errCode;
+    return RuntimeContext::GetInstance()->RunPermissionCheck(param, storage->GetProperty(), flag);
 }
 
 std::pair<TimeOffset, TimeOffset> SingleVerDataSyncUtils::GetTimeOffsetFromRequestMsg(const Message *message)
diff --git a/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync_utils.h b/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync_utils.h
index 1fa99eaf162dc840cc7eec940157aa04c1f7a99d..269cb17b06aa9bbef1ff08762795fdbdc4725d42 100644
--- a/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync_utils.h
+++ b/frameworks/libs/distributeddb/syncer/src/device/singlever/single_ver_data_sync_utils.h
@@ -19,6 +19,7 @@
 #include "single_ver_data_packet.h"
 #include "single_ver_data_sync.h"
 #include "single_ver_sync_task_context.h"
+#include "types_export.h"
 namespace DistributedDB {
 class SingleVerDataSyncUtils {
 public:
@@ -43,12 +44,9 @@ public:
 
     static void TranslateErrCodeIfNeed(int mode, uint32_t version, int &errCode);
 
-    static int RunPermissionCheck(SingleVerSyncTaskContext *context, const SyncGenericInterface* storage,
+    static PermissionCheckRet RunPermissionCheck(SingleVerSyncTaskContext *context, const SyncGenericInterface* storage,
         const std::string &label, const DataRequestPacket *packet);
 
-    static int RunPermissionCheck(SingleVerSyncTaskContext *context, const SyncGenericInterface* storage,
-        const std::string &label, int mode);
-
     static bool CheckPermitReceiveData(const SingleVerSyncTaskContext *context, const ICommunicator *communicator,
         const SyncGenericInterface *storage);
 
@@ -118,8 +116,8 @@ public:
     static QuerySyncObject GetQueryFromDataRequest(const DataRequestPacket &packet,
         const SingleVerSyncTaskContext &context, uint32_t sessionId);
 private:
-    static int RunPermissionCheckInner(const SingleVerSyncTaskContext *context, const SyncGenericInterface* storage,
-        const std::string &label, const DataRequestPacket *packet, int mode);
+    static PermissionCheckRet RunPermissionCheckInner(const SingleVerSyncTaskContext *context,
+        const SyncGenericInterface* storage, const std::string &label, const DataRequestPacket *packet, int mode);
 };
 }
 #endif // SINGLE_VER_DATA_SYNC_UTIL_H
\ No newline at end of file
diff --git a/frameworks/libs/distributeddb/syncer/src/device/sync_task_context.cpp b/frameworks/libs/distributeddb/syncer/src/device/sync_task_context.cpp
index 2e47baf439cb7c7179299e9471e0a5827a1d57c1..1ee906dc05b5bdfadbdc3c7a4550003254c78615 100644
--- a/frameworks/libs/distributeddb/syncer/src/device/sync_task_context.cpp
+++ b/frameworks/libs/distributeddb/syncer/src/device/sync_task_context.cpp
@@ -267,11 +267,12 @@ int SyncTaskContext::GetNextTarget(uint32_t timeout)
 {
     MoveToNextTarget(timeout);
     int checkErrCode = RunPermissionCheck(GetPermissionCheckFlag(IsAutoSync(), GetMode()));
-    if (checkErrCode != E_OK) {
+    if (checkErrCode == -E_FINISHED) {
+        SetOperationStatus(SyncOperation::OP_FINISHED_ALL);
+    } else if (checkErrCode != E_OK) {
         SetOperationStatus(SyncOperation::OP_PERMISSION_CHECK_FAILED);
-        return checkErrCode;
     }
-    return E_OK;
+    return checkErrCode;
 }
 
 uint32_t SyncTaskContext::GetSyncId() const
@@ -774,20 +775,34 @@ void SyncTaskContext::Dump(int fd)
         deviceId_.c_str(), totalSyncTaskCount, autoSyncTaskCount, reponseTaskCount);
 }
 
-int SyncTaskContext::RunPermissionCheck(uint8_t flag) const
+int SyncTaskContext::RunPermissionCheck(uint8_t flag)
 {
     std::string appId = syncInterface_->GetDbProperties().GetStringProp(DBProperties::APP_ID, "");
     std::string userId = syncInterface_->GetDbProperties().GetStringProp(DBProperties::USER_ID, "");
     std::string storeId = syncInterface_->GetDbProperties().GetStringProp(DBProperties::STORE_ID, "");
     std::string subUserId = syncInterface_->GetDbProperties().GetStringProp(DBProperties::SUB_USER, "");
     int32_t instanceId = syncInterface_->GetDbProperties().GetIntProp(DBProperties::INSTANCE_ID, 0);
-    int errCode = RuntimeContext::GetInstance()->RunPermissionCheck(
-        { userId, appId, storeId, deviceId_, subUserId, instanceId }, flag);
-    if (errCode != E_OK) {
-        LOGE("[SyncTaskContext] RunPermissionCheck not pass errCode:%d, flag:%d, %s{private}",
-            errCode, flag, deviceId_.c_str());
+    auto checkRet = RuntimeContext::GetInstance()->RunPermissionCheck(
+        { userId, appId, storeId, deviceId_, subUserId, instanceId }, syncInterface_->GetProperty(), flag);
+    if (!checkRet.isPass) {
+        return -E_NOT_PERMIT;
     }
-    return errCode;
+    if (checkRet.ret != DataFlowCheckRet::DENIED_SEND) {
+        return E_OK;
+    }
+    int mode = SyncOperation::TransferSyncMode(mode_);
+    if (mode == SyncModeType::PUSH || mode == SyncModeType::AUTO_PUSH) {
+        LOGW("[SyncTaskContext] skip push by denied send");
+        return -E_FINISHED;
+    }
+    if (mode_ == SyncModeType::PUSH_AND_PULL) {
+        LOGW("[SyncTaskContext] change mode from PUSH_AND_PULL to PULL");
+        SetMode(SyncModeType::PULL);
+    } else if (mode_ == SyncModeType::QUERY_PUSH_PULL) {
+        LOGW("[SyncTaskContext] change mode from QUERY_PUSH_PULL to QUERY_PULL");
+        SetMode(SyncModeType::QUERY_PULL);
+    }
+    return E_OK;
 }
 
 uint8_t SyncTaskContext::GetPermissionCheckFlag(bool isAutoSync, int syncMode)
diff --git a/frameworks/libs/distributeddb/syncer/src/device/sync_task_context.h b/frameworks/libs/distributeddb/syncer/src/device/sync_task_context.h
index 2e06aa3311b0e759baa0b03db9713f3e6aaa0272..5bb36c8efba5a14ce40f1953d66149bb0d84f9fe 100644
--- a/frameworks/libs/distributeddb/syncer/src/device/sync_task_context.h
+++ b/frameworks/libs/distributeddb/syncer/src/device/sync_task_context.h
@@ -248,7 +248,7 @@ protected:
 
     virtual void SaveLastPushTaskExecStatus(int finalStatus);
 
-    int RunPermissionCheck(uint8_t flag) const;
+    int RunPermissionCheck(uint8_t flag);
 
     SyncOperation *GetAndIncSyncOperation() const;
 
diff --git a/frameworks/libs/distributeddb/test/BUILD.gn b/frameworks/libs/distributeddb/test/BUILD.gn
index 49290b71ded5217644b609d260435a29a676564f..1bd571524701d3b896d467c25a8c0acc2853c3cc 100644
--- a/frameworks/libs/distributeddb/test/BUILD.gn
+++ b/frameworks/libs/distributeddb/test/BUILD.gn
@@ -967,6 +967,18 @@ distributeddb_unittest("DistributedDBKVNotifyTest") {
   sources = [ "unittest/common/store_test/kv/distributeddb_kv_notify_test.cpp" ]
 }
 
+distributeddb_unittest("DistributedDBKvPermissionSyncTest") {
+  sources = [
+    "unittest/common/store_test/kv/distributeddb_kv_permission_sync_test.cpp",
+  ]
+}
+
+distributeddb_unittest("DistributedDBRDBPermissionSyncTest") {
+  sources = [
+    "unittest/common/store_test/rdb/distributeddb_rdb_permission_sync_test.cpp",
+  ]
+}
+
 config("tokenizer_config_unittest") {
   visibility = [ ":*" ]
   include_dirs = [ "//foundation/distributeddatamgr/kv_store/frameworks/libs/distributeddb/common/include" ]
@@ -1246,6 +1258,7 @@ group("unittest") {
     ":DistributedDBKvCloudSyncTest",
     ":DistributedDBKvDeviceSyncTest",
     ":DistributedDBKvMultiUserSyncTest",
+    ":DistributedDBKvPermissionSyncTest",
     ":DistributedDBMetaDataTest",
     ":DistributedDBMockSyncModuleTest",
     ":DistributedDBMultiVerP2PSyncTest",
@@ -1260,6 +1273,7 @@ group("unittest") {
     ":DistributedDBRDBKnowledgeClientTest",
     ":DistributedDBRDBKnowledgeTest",
     ":DistributedDBRDBMultiUserSyncTest",
+    ":DistributedDBRDBPermissionSyncTest",
     ":DistributedDBRDBUpgradeTest",
     ":DistributedDBRelationalCloudSyncableStorageTest",
     ":DistributedDBRelationalEncryptedDbTest",
diff --git a/frameworks/libs/distributeddb/test/unittest/common/common/distributeddb_tools_unit_test.cpp b/frameworks/libs/distributeddb/test/unittest/common/common/distributeddb_tools_unit_test.cpp
index 253f8149f7d1db6710a46a03014f6b21f607e618..83f9cb855b1e2c2fd9d8100dbc2e5a7c1cb94bee 100644
--- a/frameworks/libs/distributeddb/test/unittest/common/common/distributeddb_tools_unit_test.cpp
+++ b/frameworks/libs/distributeddb/test/unittest/common/common/distributeddb_tools_unit_test.cpp
@@ -1590,6 +1590,22 @@ void DistributedDBToolsUnitTest::BlockSync(KvStoreNbDelegate *delegate, Distribu
     }
 }
 
+DistributedDB::Entry DistributedDBToolsUnitTest::GetK1V1()
+{
+    DistributedDB::Entry entry;
+    entry.key = {'k', '1'};
+    entry.value = {'v', '1'};
+    return entry;
+}
+
+DistributedDB::Entry DistributedDBToolsUnitTest::GetK2V2()
+{
+    DistributedDB::Entry entry;
+    entry.key = {'k', '2'};
+    entry.value = {'v', '2'};
+    return entry;
+}
+
 std::pair<int, uint64_t> RelationalTestUtils::GetMaxTimestamp(sqlite3 *db, const std::string &oriTable)
 {
     std::pair<int, uint64_t> res;
diff --git a/frameworks/libs/distributeddb/test/unittest/common/common/distributeddb_tools_unit_test.h b/frameworks/libs/distributeddb/test/unittest/common/common/distributeddb_tools_unit_test.h
index b12ad575fb26ea782eaed120e54ee24ccdfd31c7..717d8b08b102d81f40709af31b076fda4861896c 100644
--- a/frameworks/libs/distributeddb/test/unittest/common/common/distributeddb_tools_unit_test.h
+++ b/frameworks/libs/distributeddb/test/unittest/common/common/distributeddb_tools_unit_test.h
@@ -241,6 +241,10 @@ public:
 
     static void BlockSync(DistributedDB::KvStoreNbDelegate *delegate, DistributedDB::DBStatus expectDBStatus,
         DistributedDB::CloudSyncOption option, DistributedDB::DBStatus expectSyncResult = DistributedDB::DBStatus::OK);
+
+    static DistributedDB::Entry GetK1V1();
+
+    static DistributedDB::Entry GetK2V2();
 private:
     static int OpenMockMultiDb(DatabaseInfo &dbInfo, DistributedDB::OpenDbProperties &properties);
 
diff --git a/frameworks/libs/distributeddb/test/unittest/common/common/rdb_general_ut.cpp b/frameworks/libs/distributeddb/test/unittest/common/common/rdb_general_ut.cpp
index 831e0a330cc08aabd6ad82b0322a03b3ada30a73..10546bae1c8f618803fa92bbc5a8db82e73d220c 100644
--- a/frameworks/libs/distributeddb/test/unittest/common/common/rdb_general_ut.cpp
+++ b/frameworks/libs/distributeddb/test/unittest/common/common/rdb_general_ut.cpp
@@ -571,6 +571,14 @@ int RDBGeneralUt::EncryptedDb(sqlite3 *db)
 }
 
 void RDBGeneralUt::RemoteQuery(const StoreInfo &from, const StoreInfo &to, const std::string &sql, DBStatus expectRet)
+{
+    std::shared_ptr<ResultSet> resultSet = nullptr;
+    RemoteQuery(from, to, sql, expectRet, resultSet);
+    EXPECT_NE(resultSet, nullptr);
+}
+
+void RDBGeneralUt::RemoteQuery(const StoreInfo &from, const StoreInfo &to, const std::string &sql, DBStatus expectRet,
+    std::shared_ptr<ResultSet> &resultSet)
 {
     auto store = GetDelegate(from);
     ASSERT_NE(store, nullptr);
@@ -578,9 +586,7 @@ void RDBGeneralUt::RemoteQuery(const StoreInfo &from, const StoreInfo &to, const
     ASSERT_FALSE(toDevice.empty());
     RemoteCondition condition;
     condition.sql = sql;
-    std::shared_ptr<ResultSet> resultSet = nullptr;
     EXPECT_EQ(store->RemoteQuery(toDevice, condition, DBConstant::MAX_TIMEOUT, resultSet), expectRet);
-    EXPECT_NE(resultSet, nullptr);
 }
 
 int RDBGeneralUt::PutMetaData(const StoreInfo &store, const Key &key, const Value &value)
diff --git a/frameworks/libs/distributeddb/test/unittest/common/common/rdb_general_ut.h b/frameworks/libs/distributeddb/test/unittest/common/common/rdb_general_ut.h
index 6eebce0a31a60ab8fa136105d3821da3d25def84..a37c2d66a93ec8d8037d3905caa9d14079023547 100644
--- a/frameworks/libs/distributeddb/test/unittest/common/common/rdb_general_ut.h
+++ b/frameworks/libs/distributeddb/test/unittest/common/common/rdb_general_ut.h
@@ -95,6 +95,8 @@ protected:
         DBStatus expectRet);
 
     void RemoteQuery(const StoreInfo &from, const StoreInfo &to, const std::string &sql, DBStatus expectRet);
+    void RemoteQuery(const StoreInfo &from, const StoreInfo &to, const std::string &sql, DBStatus expectRet,
+        std::shared_ptr<ResultSet> &resultSet);
 
     int PutMetaData(const StoreInfo &store, const Key &key, const Value &value);
 
diff --git a/frameworks/libs/distributeddb/test/unittest/common/store_test/kv/distributeddb_kv_permission_sync_test.cpp b/frameworks/libs/distributeddb/test/unittest/common/store_test/kv/distributeddb_kv_permission_sync_test.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..d5c92c868aba9c40fd27d29ff3a33dcdd34682ae
--- /dev/null
+++ b/frameworks/libs/distributeddb/test/unittest/common/store_test/kv/distributeddb_kv_permission_sync_test.cpp
@@ -0,0 +1,324 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "distributeddb_tools_unit_test.h"
+#include "kv_general_ut.h"
+#include "kv_store_nb_delegate_impl.h"
+#include "runtime_config.h"
+#include "sqlite_single_ver_natural_store_connection.h"
+
+namespace DistributedDB {
+using namespace testing::ext;
+using namespace DistributedDB;
+using namespace DistributedDBUnitTest;
+
+class DistributedDBKvPermissionSyncTest : public KVGeneralUt {
+public:
+    void SetUp() override;
+    void TearDown() override;
+protected:
+    void PrepareData();
+    void CheckData(const StoreInfo &info, const Entry &expectEntry, DBStatus status);
+    static constexpr const char *DEVICE_A = "DEVICE_A";
+    static constexpr const char *DEVICE_B = "DEVICE_B";
+};
+
+void DistributedDBKvPermissionSyncTest::SetUp()
+{
+    KVGeneralUt::SetUp();
+    auto storeInfo1 = GetStoreInfo1();
+    ASSERT_EQ(BasicUnitTest::InitDelegate(storeInfo1, DEVICE_A), E_OK);
+    auto storeInfo2 = GetStoreInfo2();
+    ASSERT_EQ(BasicUnitTest::InitDelegate(storeInfo2, DEVICE_B), E_OK);
+    ASSERT_NO_FATAL_FAILURE(PrepareData());
+    RuntimeConfig::SetDataFlowCheckCallback([storeInfo1, storeInfo2](const PermissionCheckParam &param,
+        const Property &property) {
+        if (param.storeId == storeInfo2.storeId) {
+            EXPECT_EQ(property.size(), 1);
+            return DataFlowCheckRet::DEFAULT;
+        }
+        EXPECT_EQ(property.size(), 0);
+        return DataFlowCheckRet::DENIED_SEND;
+    });
+}
+
+void DistributedDBKvPermissionSyncTest::TearDown()
+{
+    RuntimeConfig::SetDataFlowCheckCallback(nullptr);
+    PermissionCheckCallbackV4 callbackV4 = nullptr;
+    RuntimeConfig::SetPermissionCheckCallback(callbackV4);
+    KVGeneralUt::TearDown();
+}
+
+void DistributedDBKvPermissionSyncTest::PrepareData()
+{
+    /**
+     * @tc.steps: step1. dev1 put (k1,v1)
+     * @tc.expected: step1. return OK
+     */
+    auto storeInfo1 = GetStoreInfo1();
+    auto store1 = GetDelegate(storeInfo1);
+    ASSERT_NE(store1, nullptr);
+    auto k1v1 = DistributedDBToolsUnitTest::GetK1V1();
+    EXPECT_EQ(store1->Put(k1v1.key, k1v1.value), OK);
+    Value actualValue;
+    EXPECT_EQ(store1->Get(k1v1.key, actualValue), OK);
+    EXPECT_EQ(k1v1.value, actualValue);
+    Property property;
+    store1->SetProperty(property);
+    /**
+     * @tc.steps: step2. dev2 put (k2,v2)
+     * @tc.expected: step2. return OK
+     */
+    auto storeInfo2 = GetStoreInfo2();
+    auto store2 = GetDelegate(storeInfo2);
+    ASSERT_NE(store2, nullptr);
+    auto k2v2 = DistributedDBToolsUnitTest::GetK2V2();
+    EXPECT_EQ(store2->Put(k2v2.key, k2v2.value), OK);
+    EXPECT_EQ(store2->Get(k2v2.key, actualValue), OK);
+    EXPECT_EQ(k2v2.value, actualValue);
+    property["field"] = std::string("field");
+    store2->SetProperty(property);
+}
+
+void DistributedDBKvPermissionSyncTest::CheckData(const StoreInfo &info, const Entry &expectEntry, DBStatus status)
+{
+    auto store = GetDelegate(info);
+    ASSERT_NE(store, nullptr);
+    Value actualValue;
+    ASSERT_EQ(store->Get(expectEntry.key, actualValue), status);
+    if (status != OK) {
+        return;
+    }
+    EXPECT_EQ(expectEntry.value, actualValue);
+}
+
+/**
+ * @tc.name: KVPermissionSync001
+ * @tc.desc: Test push OK by permission callback denied.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, KVPermissionSync001, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev1 sync to dev2
+     * @tc.expected: step1. sync ok
+     */
+    BlockDeviceSync(GetStoreInfo1(), GetStoreInfo2(), SyncMode::SYNC_MODE_PUSH_ONLY, DBStatus::OK);
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK1V1(), OK));
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo2(), DistributedDBToolsUnitTest::GetK1V1(), NOT_FOUND));
+}
+
+/**
+ * @tc.name: KVPermissionSync002
+ * @tc.desc: Test pull ok with permission callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, KVPermissionSync002, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev1 sync to dev2
+     * @tc.expected: step1. sync ok and dev1 exist (K1,V1) (K2,V2)
+     */
+    BlockDeviceSync(GetStoreInfo1(), GetStoreInfo2(), SyncMode::SYNC_MODE_PULL_ONLY, OK);
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK1V1(), OK));
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK2V2(), OK));
+}
+
+/**
+ * @tc.name: KVPermissionSync003
+ * @tc.desc: Test push pull ok with permission callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, KVPermissionSync003, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev1 sync to dev2
+     * @tc.expected: step1. sync ok and dev1 exist (K1,V1) (K2,V2)
+     */
+    BlockDeviceSync(GetStoreInfo1(), GetStoreInfo2(), SyncMode::SYNC_MODE_PUSH_PULL, OK);
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK1V1(), OK));
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK2V2(), OK));
+}
+
+/**
+ * @tc.name: KVPermissionSync004
+ * @tc.desc: Test push ok with permission callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, KVPermissionSync004, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev2 sync to dev1
+     * @tc.expected: step1. sync ok and dev1 exist (K1,V1) (K2,V2)
+     */
+    BlockDeviceSync(GetStoreInfo2(), GetStoreInfo1(), SyncMode::SYNC_MODE_PUSH_ONLY, OK);
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK1V1(), OK));
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK2V2(), OK));
+}
+
+/**
+ * @tc.name: KVPermissionSync005
+ * @tc.desc: Test push OK by permission callback denied.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, KVPermissionSync005, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev2 sync to dev1
+     * @tc.expected: step1. sync OK
+     */
+    BlockDeviceSync(GetStoreInfo2(), GetStoreInfo1(), SyncMode::SYNC_MODE_PULL_ONLY,
+        DBStatus::OK);
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK1V1(), OK));
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo2(), DistributedDBToolsUnitTest::GetK1V1(), NOT_FOUND));
+}
+
+/**
+ * @tc.name: KVPermissionSync006
+ * @tc.desc: Test push pull ok with permission callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, KVPermissionSync006, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev2 sync to dev1
+     * @tc.expected: step1. sync ok and dev1 exist (K1,V1) (K2,V2)
+     */
+    BlockDeviceSync(GetStoreInfo2(), GetStoreInfo1(), SyncMode::SYNC_MODE_PUSH_PULL, OK);
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK1V1(), OK));
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK2V2(), OK));
+}
+
+/**
+ * @tc.name: KVPermissionSync007
+ * @tc.desc: Test push pull ok with process callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, KVPermissionSync007, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev2 sync to dev1
+     * @tc.expected: step1. sync ok and dev2 only exist (K2,V2)
+     */
+    auto fromStore = GetDelegate(GetStoreInfo2());
+    ASSERT_NE(fromStore, nullptr);
+    std::map<std::string, DeviceSyncProcess> syncProcessMap;
+    DeviceSyncOption option;
+    option.devices = {DEVICE_A};
+    option.mode = SYNC_MODE_PULL_ONLY;
+    option.query = Query::Select().PrefixKey({'k'});
+    option.isQuery = true;
+    option.isWait = false;
+    DistributedDBToolsUnitTest tool;
+    DBStatus status = tool.SyncTest(fromStore, option, syncProcessMap);
+    EXPECT_EQ(status, DBStatus::OK);
+    for (const auto &item : syncProcessMap) {
+        EXPECT_EQ(item.second.pullInfo.total, 0);
+        EXPECT_EQ(item.second.pullInfo.finishedCount, 0);
+    }
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo2(), DistributedDBToolsUnitTest::GetK1V1(), NOT_FOUND));
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo2(), DistributedDBToolsUnitTest::GetK2V2(), OK));
+}
+
+/**
+ * @tc.name: KVPermissionSync008
+ * @tc.desc: Test push pull failed with permission callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, KVPermissionSync008, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev2 sync to dev1
+     * @tc.expected: step1. sync failed by permission denied
+     */
+    auto storeInfo1 = GetStoreInfo1();
+    RuntimeConfig::SetPermissionCheckCallback([storeInfo1](const PermissionCheckParamV4 &param, uint8_t) {
+        if (storeInfo1.storeId == param.storeId) {
+            return false;
+        }
+        return true;
+    });
+    BlockDeviceSync(GetStoreInfo2(), storeInfo1, SyncMode::SYNC_MODE_PUSH_PULL, PERMISSION_CHECK_FORBID_SYNC);
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK1V1(), OK));
+    EXPECT_NO_FATAL_FAILURE(CheckData(GetStoreInfo1(), DistributedDBToolsUnitTest::GetK2V2(), NOT_FOUND));
+}
+
+/**
+ * @tc.name: MockAPITest001
+ * @tc.desc: Test kvStoreNbDelegate api.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, MockAPITest001, TestSize.Level0)
+{
+    class VirtualKvStoreNbDelegate : public KvStoreNbDelegateImpl {
+    public:
+        VirtualKvStoreNbDelegate() : KvStoreNbDelegateImpl(nullptr, "store")
+        {
+        }
+
+        DBStatus SetProperty(const Property &property) override
+        {
+            return KvStoreNbDelegate::SetProperty(property);
+        }
+    };
+    VirtualKvStoreNbDelegate store;
+    EXPECT_EQ(store.SetProperty({}), OK);
+}
+
+/**
+ * @tc.name: InvalidArgs001
+ * @tc.desc: Test invalid use api.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, InvalidArgs001, TestSize.Level0)
+{
+    KvStoreNbDelegateImpl store(nullptr, "store");
+    EXPECT_EQ(store.SetProperty({}), DB_ERROR);
+}
+
+/**
+ * @tc.name: InvalidArgs002
+ * @tc.desc: Test invalid use api.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBKvPermissionSyncTest, InvalidArgs002, TestSize.Level0)
+{
+    class VirtualConnection : public SQLiteSingleVerNaturalStoreConnection {
+    public:
+        VirtualConnection() : SQLiteSingleVerNaturalStoreConnection(nullptr)
+        {
+        }
+
+        int SetProperty(const Property &property) override
+        {
+            return GenericKvDBConnection::SetProperty(property);
+        }
+    };
+    VirtualConnection connection;
+    EXPECT_EQ(connection.SetProperty({}), -E_INVALID_CONNECTION);
+}
+}
\ No newline at end of file
diff --git a/frameworks/libs/distributeddb/test/unittest/common/store_test/rdb/distributeddb_rdb_permission_sync_test.cpp b/frameworks/libs/distributeddb/test/unittest/common/store_test/rdb/distributeddb_rdb_permission_sync_test.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..8f5add00c128a45e2e7ee2face42ede383bd5e01
--- /dev/null
+++ b/frameworks/libs/distributeddb/test/unittest/common/store_test/rdb/distributeddb_rdb_permission_sync_test.cpp
@@ -0,0 +1,253 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "rdb_general_ut.h"
+#include "relational_store_delegate_impl.h"
+#include "runtime_config.h"
+#include "sqlite_relational_store.h"
+#include "sqlite_relational_store_connection.h"
+
+namespace DistributedDB {
+using namespace testing::ext;
+using namespace DistributedDB;
+using namespace DistributedDBUnitTest;
+
+class DistributedDBRDBPermissionSyncTest : public RDBGeneralUt {
+public:
+    void SetUp() override;
+    void TearDown() override;
+protected:
+    void PrepareData();
+    static UtDateBaseSchemaInfo GetDefaultSchema();
+    static UtTableSchemaInfo GetTableSchema(const std::string &table);
+
+    static constexpr const char *DEVICE_SYNC_TABLE = "DEVICE_SYNC_TABLE";
+    static constexpr const char *DEVICE_A = "DEVICE_A";
+    static constexpr const char *DEVICE_B = "DEVICE_B";
+    const StoreInfo info1_ = {USER_ID, APP_ID, STORE_ID_1};
+    const StoreInfo info2_ = {USER_ID, APP_ID, STORE_ID_2};
+};
+
+void DistributedDBRDBPermissionSyncTest::SetUp()
+{
+    RDBGeneralUt::SetUp();
+    RelationalStoreDelegate::Option option;
+    option.tableMode = DistributedTableMode::COLLABORATION;
+    SetOption(option);
+    SetSchemaInfo(info1_, GetDefaultSchema());
+    SetSchemaInfo(info2_, GetDefaultSchema());
+    ASSERT_EQ(BasicUnitTest::InitDelegate(info1_, DEVICE_A), E_OK);
+    ASSERT_EQ(BasicUnitTest::InitDelegate(info2_, DEVICE_B), E_OK);
+    ASSERT_EQ(SetDistributedTables(info1_, {DEVICE_SYNC_TABLE}), E_OK);
+    ASSERT_EQ(SetDistributedTables(info2_, {DEVICE_SYNC_TABLE}), E_OK);
+    ASSERT_NO_FATAL_FAILURE(PrepareData());
+    RuntimeConfig::SetDataFlowCheckCallback([storeInfo1 = info1_, storeInfo2 = info2_](
+        const PermissionCheckParam &param, const Property &property) {
+        if (param.storeId == storeInfo2.storeId) {
+            EXPECT_EQ(property.size(), 1);
+            return DataFlowCheckRet::DEFAULT;
+        }
+        EXPECT_EQ(property.size(), 0);
+        return DataFlowCheckRet::DENIED_SEND;
+    });
+}
+
+void DistributedDBRDBPermissionSyncTest::TearDown()
+{
+    RuntimeConfig::SetDataFlowCheckCallback(nullptr);
+    RDBGeneralUt::TearDown();
+}
+
+UtDateBaseSchemaInfo DistributedDBRDBPermissionSyncTest::GetDefaultSchema()
+{
+    UtDateBaseSchemaInfo info;
+    info.tablesInfo.push_back(GetTableSchema(DEVICE_SYNC_TABLE));
+    return info;
+}
+
+UtTableSchemaInfo DistributedDBRDBPermissionSyncTest::GetTableSchema(const std::string &table)
+{
+    UtTableSchemaInfo tableSchema;
+    tableSchema.name = table;
+    UtFieldInfo field;
+    field.field.colName = "id";
+    field.field.type = TYPE_INDEX<int64_t>;
+    field.field.primary = true;
+    tableSchema.fieldInfo.push_back(field);
+    field.field.colName = "val";
+    field.field.type = TYPE_INDEX<std::string>;
+    field.field.primary = false;
+    tableSchema.fieldInfo.push_back(field);
+    return tableSchema;
+}
+
+void DistributedDBRDBPermissionSyncTest::PrepareData()
+{
+    EXPECT_EQ(InsertLocalDBData(0, 1, info1_), E_OK);
+    EXPECT_EQ(CountTableData(info1_, DEVICE_SYNC_TABLE, " id = 0 "), 1);
+    EXPECT_EQ(InsertLocalDBData(1, 1, info2_), E_OK);
+    EXPECT_EQ(CountTableData(info2_, DEVICE_SYNC_TABLE, " id = 1 "), 1);
+    auto store = GetDelegate(info1_);
+    ASSERT_NE(store, nullptr);
+    Property property;
+    EXPECT_EQ(store->SetProperty(property), OK);
+    store = GetDelegate(info2_);
+    ASSERT_NE(store, nullptr);
+    property["field"] = std::string("field");
+    EXPECT_EQ(store->SetProperty(property), OK);
+}
+
+/**
+ * @tc.name: RDBPermissionSync001
+ * @tc.desc: Test push OK by permission callback denied.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBRDBPermissionSyncTest, RDBPermissionSync001, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev1 sync to dev2
+     * @tc.expected: step1. sync OK
+     */
+    BlockPush(info1_, info2_, DEVICE_SYNC_TABLE, OK);
+    EXPECT_EQ(CountTableData(info2_, DEVICE_SYNC_TABLE, " id = 0 "), 0);
+}
+
+/**
+ * @tc.name: RDBPermissionSync002
+ * @tc.desc: Test pull ok with permission callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBRDBPermissionSyncTest, RDBPermissionSync002, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev1 sync to dev2
+     * @tc.expected: step1. sync ok
+     */
+    BlockPull(info1_, info2_, DEVICE_SYNC_TABLE, OK);
+    EXPECT_EQ(CountTableData(info1_, DEVICE_SYNC_TABLE, " id = 1 "), 1);
+}
+
+/**
+ * @tc.name: RDBPermissionSync003
+ * @tc.desc: Test push ok with permission callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBRDBPermissionSyncTest, RDBPermissionSync003, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev2 sync to dev1
+     * @tc.expected: step1. sync ok
+     */
+    BlockPush(info2_, info1_, DEVICE_SYNC_TABLE, OK);
+    EXPECT_EQ(CountTableData(info1_, DEVICE_SYNC_TABLE, " id = 1 "), 1);
+}
+
+/**
+ * @tc.name: RDBPermissionSync004
+ * @tc.desc: Test pull OK by permission callback denied.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBRDBPermissionSyncTest, RDBPermissionSync004, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev1 sync to dev2
+     * @tc.expected: step1. sync OK
+     */
+    BlockPull(info2_, info1_, DEVICE_SYNC_TABLE, OK);
+    EXPECT_EQ(CountTableData(info2_, DEVICE_SYNC_TABLE, " id = 0 "), 0);
+}
+
+/**
+ * @tc.name: RDBPermissionQuery001
+ * @tc.desc: Test remote query ok with permission callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBRDBPermissionSyncTest, RDBPermissionQuery001, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev1 remote query to dev2
+     * @tc.expected: step1. sync ok
+     */
+    std::shared_ptr<ResultSet> resultSet = nullptr;
+    ASSERT_NO_FATAL_FAILURE(RemoteQuery(info1_, info2_, "SELECT * FROM DEVICE_SYNC_TABLE WHERE id = 1", OK, resultSet));
+    ASSERT_NE(resultSet, nullptr);
+    EXPECT_EQ(resultSet->GetCount(), 1);
+    resultSet->Close();
+}
+
+/**
+ * @tc.name: RDBPermissionQuery002
+ * @tc.desc: Test remote query ok with permission callback.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBRDBPermissionSyncTest, RDBPermissionQuery002, TestSize.Level0)
+{
+    /**
+     * @tc.steps: step1. dev1 remote query to dev2
+     * @tc.expected: step1. sync ok
+     */
+    std::shared_ptr<ResultSet> resultSet = nullptr;
+    ASSERT_NO_FATAL_FAILURE(RemoteQuery(info2_, info1_, "SELECT * FROM DEVICE_SYNC_TABLE WHERE id = 0",
+        OK, resultSet));
+    ASSERT_NE(resultSet, nullptr);
+    EXPECT_EQ(resultSet->GetCount(), 0);
+    resultSet->Close();
+}
+
+/**
+ * @tc.name: MockAPITest001
+ * @tc.desc: Test rdbStoreNbDelegate api.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBRDBPermissionSyncTest, MockAPITest001, TestSize.Level0)
+{
+    class MockRelationalStoreDelegate : public RelationalStoreDelegateImpl {
+    public:
+        MockRelationalStoreDelegate() : RelationalStoreDelegateImpl(nullptr, "store")
+        {
+        }
+
+        DBStatus SetProperty(const Property &property) override
+        {
+            return RelationalStoreDelegate::SetProperty(property);
+        }
+    };
+    MockRelationalStoreDelegate store;
+    EXPECT_EQ(store.SetProperty({}), OK);
+}
+
+/**
+ * @tc.name: InvalidArgs001
+ * @tc.desc: Test invalid use api.
+ * @tc.type: FUNC
+ * @tc.author: zqq
+ */
+HWTEST_F(DistributedDBRDBPermissionSyncTest, InvalidArgs001, TestSize.Level0)
+{
+    RelationalStoreDelegateImpl store(nullptr, "store");
+    EXPECT_EQ(store.SetProperty({}), DB_ERROR);
+    SQLiteRelationalStore relationalStore;
+    EXPECT_EQ(relationalStore.SetProperty({}), -E_INVALID_DB);
+    SQLiteRelationalStoreConnection connection(nullptr);
+    EXPECT_EQ(connection.SetProperty({}), -E_INVALID_CONNECTION);
+}
+}
\ No newline at end of file